We are experimenting with MQTT in our project.
We have a secure connection to our mqtt broker, so mqtt over TLS (or mqtts) and we use a proper signed certificate (not self-signed) from a trusted source.
With some of our clients we have to pass the CA root certificate (of the certificate provider that signed our server certificate) to allow for a successful handshake procedure.
For example when using mosquitto:
# Publish mosquitto_pub -h 'mqtt.example.com' -p 8883 --cafile "path/to/certificate/ca.pem" -u "username" -P "password" -t "planet/earth" -m "hello world" # Subscribe mosquitto_sub -h 'mqtt.example.com' -p 8883 -t "planet/earth" --cafile "path/to/certificate/ca.pem" -u "username" -P "password" -v -d
If we don't pass the CA-certificate in these examples above we cannot connect (connection is refused).
But when using this node MQTT client we don't need to pass the CA root certificate. Why not? I suspect that this node MQTT client uses the certificate store on my computer to validate our server certificate, but I cannot find any confirmation on this in the documentation.
I am careful and that is why I don't just want to jump to this conclusion, since there might as well be something wrong with the MQTT server/broker configuration that allows connecting without validating the server certificate properly?
So the question: does node-mqtt use the certificate store on my computer? Or does it have a store with trusted CA root certificates?